Senior Security Engineer, Application Security

Own Kikoff’s Application Security pillar, drive the AppSec roadmap, and help engineering move fast with security as the default.

Responsibilities

• Drive the application security roadmap across secure SDLC, code review, threat modeling, vulnerability management, plus pentest and bug bounty programs
• Define what secure code means at Kikoff and build enforcement tooling, including SAST, SCA, secrets scanning, and dependency policies integrated into CI with actionable signal for engineers
• Set the approach for AI-generated code review and gating in a codebase where agents contribute
• Build “paved roads” into engineering workflows: authn/authz libraries, input validation, and safe defaults for common patterns
• Own security for authentication and session systems, including MFA design, account recovery, session management, and defenses against credential stuffing and account takeover
• Secure APIs and mobile apps through authorization models, rate limiting, abuse controls, certificate pinning, and secure storage practices on device
• Secure AI features shipped to customers, including prompt injection defenses, tool permission boundaries, and data exposure controls for LLM-backed workflows
• Run penetration testing and bug bounty programs: triage findings, drive remediation, and close the loop with engineering
• Build vulnerability management with audit-grade evidence: defined SLAs, tracked remediation, and artifacts supporting PCI-DSS, SOC 2, and IPO readiness controls
• Threat model new products and major features before launch
• Partner with product engineering design reviews as a security advisor with clear answers, fast turnaround, and practical fixes
• Stand up and run a security champions program so AppSec scales beyond a single engineer
• Build internal tooling, including AI-assisted review and triage, to multiply team impact

Requirements

• 6+ years in security engineering with hands-on application security experience, including secure code review, threat modeling, vulnerability triage, and remediation at scale
• Can write production code; fluent in at least one of Ruby, Python, Go, or TypeScript, with comfort reading the others
• Designed and shipped authentication and authorization systems, including OAuth/OIDC, session management, MFA, and account recovery
• Hands-on with modern AppSec tooling and the judgment to validate results using SAST, SCA, DAST, secrets scanning, and CI/CD integration
• Experience securing REST/GraphQL APIs and native mobile applications
• Experience running or building a pentest or bug bounty program
• Comfort operating in a fintech regulated environment such as PCI-DSS and SOC 2 (or similar)

Technologies

• Ruby, Python, Go, TypeScript
• SAST, SCA, secrets scanning
• CI/CD, DAST
• OAuth/OIDC
• REST, GraphQL
• PCI-DSS, SOC 2

Bonus points

• Securing LLM-backed product features or agentic workloads in production
• Fraud and abuse defense experience, including bot detection, credential stuffing mitigation, and device signals
• Launched security champions or developer education programs (not inherited)
• Supply chain security depth: dependency provenance, artifact signing, build integrity
• Consumer fintech or financial services background

Location: San Francisco, CA (onsite)

Experience: 6+ years

Base salary: USD 268,000 - 321,000 per year